iGaming & Gambling Compliance in Brazil

As of 11 November 2026 the Brazilian market is closed to fixed-odds betting, both online and land-based. Other lottery products authorised by law are outside the ban. The question for operators and their suppliers is no longer how to onboard players but how to wind down cleanly and what happens if the ban is not converted into law.

The Prizes and Betting Secretariat (SPA) of the Ministry of Finance supervises the wind-down. The Central Bank of Brazil and the National Monetary Council set the payment-blocking rules, and the Ministry of Justice and Public Security and consumer-protection bodies enforce the advertising and platform duties.

The biggest obstacle for any entrant is legal uncertainty: the regime that applied until September 2026, with strict facial-recognition onboarding, could return if the provisional measure lapses, is struck down or is changed by Congress, and the effect of a lapse or ruling on the extinguished licences is not settled.

1. Who regulates this sector

The Federal Supreme Court (STF) is reviewing the ban's constitutionality, and an inter-agency committee of 15 representatives from 11 federal bodies, coordinated by the Chief of Staff's Office (Casa Civil), coordinates enforcement, keeps a unified register of betting domains, apps and accounts and reports every six months (MP 1.394/2026, art. 24; Decreto nº 13.128/2026, arts. 3 and 4).

2. Licensing and authorisation

Medida Provisória nº 1.394, de 25 de setembro de 2026 (Provisional Measure 1.394/2026) [In force, not yet converted into law] prohibits the operation, offer, intermediation and advertising of fixed-odds betting in Brazil, in physical or virtual form, including by operators based abroad that offer it to people located in Brazil (art. 1). The ban covers bets on real sporting events and on virtual online-game events, meaning random-number games of the online casino type. Other lottery products authorised by law are not covered (art. 1, §2). The government cited household debt, mental health harm and exposure of minors (EXM 2114/2026).

No new licences

From 25 September 2026 no new federal, state or district authorisation may be granted, and pending applications lapsed (art. 6).

Existing licences extinguished

Authorisations granted under Lei nº 14.790/2023 were extinguished 30 days after publication, without refund of the licence fee or compensation (art. 4). State concessions ended on the same timetable (art. 2).

Legal basis removed

The provisional measure revoked most of Law 14.790/2023 (arts. 1 to 40, 43 to 48 and 54, leaving the later-inserted arts. 21-A and 24-A to 24-C) and the fixed-odds chapter of Law 13.756/2018 (arts. 29 to 35).

The wind-down timetable

From 25 September 2026 no new player funds could come in. Sites and apps went offline after ten days, open bets were voided and refunded, and operators had two days to fund refunds and send banks a per-player list by tax number (CPF) (arts. 7 and 8). Banks had seven days to repay players, with the rest moved to Caixa Econômica Federal (art. 9); unfunded refunds cost R$ 200,000 a day (art. 8, §2).

Portaria SPA/MF nº 3.005/2026 sets the final deadlines: player balances as at 23:59:59 on 5 October 2026 were due through the Betting Management System (SIGAP) by 7 October, and all remaining regulatory, financial, accounting and reporting obligations, including payment of legal levies, must be completed by 15 December 2026 (arts. 3 to 5). A legal representative must stay reachable (art. 2).

What remains lawful

Lottery modalities other than fixed-odds betting remain authorised. Fantasy sport needs no authorisation (Law 14.790/2023, art. 49, not revoked). Derivatives on sporting, online-game, political or entertainment events are banned (Resolução CMN nº 5.298/2026, art. 3), and the SPA treats such prediction markets as illegal betting (Technical Note 2958/2026).

3. AML, KYC and customer due diligence

Under Lei nº 9.613, de 3 de março de 1998 (the AML Law), art. 9, sole paragraph, VI, companies that distribute money or goods through draws, lotteries "including fixed-odds betting" or other betting systems are obliged persons. They must identify customers and keep records updated, register with their supervisor, keep records for at least five years and report suspicious operations to COAF within 24 hours without tipping off (arts. 10 and 11). Lottery operators that remain lawful stay in scope, supervised for these duties by the SPA (Decreto nº 11.907/2024, Annex I, art. 55, V).

Lotteries that remain lawful

Portaria MF nº 537/2013 sets the AML procedures for federal, state and district lottery operators. They must register prize winners (name, CPF, identity document and PEP status), record every identified prize payment, report cash or bearer-cheque prizes of R$ 10,000 or more to COAF, and keep records for five years from payment (arts. 3, 5, 7 and 10).

Obligations that survive the ban

Extinguishing a licence does not end obligations for the period of operation: AML and counter-terrorist financing, responsible gambling and sporting integrity duties, cooperation with authorities, and keeping records on players, bets, financial operations and prizes for at least five years (MP 1.394/2026, art. 10). Data on players, bets, deposits, withdrawals and refunds must still be sent to SIGAP (art. 11).

The AML regime former licensees were held to

Portaria SPA/MF nº 1.143/2024 required licensed operators to take a risk-based approach, check politically exposed person (PEP) status, analyse flagged bets within 30 days, report to COAF by the next business day after the analysis, file an annual nil report and keep records for five years (arts. 14, 16 and 24 to 32).

Payment-side duties now carry the weight

Once the SPA identifies an unauthorised operator, financial and payment institutions and scheme owners must block its accounts, stop new transactions and, since the provisional measure, report related operations to COAF (Law 14.790/2023, art. 21-A [In force]). Art. 24-C requires enhanced due diligence against payments to unauthorised operators.

4. Identity verification and onboarding

No player onboarding for fixed-odds betting is lawful while the ban stands. Identity data still matters for refunds, which identified each player by CPF and date of birth and were paid only into an active account in the player's own name (MP 1.394/2026, art. 9; Portaria SPA/MF 3.005/2026, art. 3), and for past onboarding records.

The onboarding standard that applied until 25 September 2026

These SPA rules also define the records former operators must keep:

• Data collected: full name, nationality, CPF, date of birth, gender, full address (not a PO box), country of domicile, verified phone and email, registered bank accounts (up to three, all in the player's name), self-set time and loss limits, the IP address at registration and a scanned photo ID: National Identity Card (CIN), RG, driving licence (CNH) or passport (Portaria SPA/MF nº 1.231/2024 as amended, art. 31).
• Biometrics: facial recognition with liveness ("prova de vida") was mandatory at registration, together with a complex password; other biometrics or a token were optional with consent (art. 31, §§3 and 4).
• Timing: identity, age (18 or over) and CPF validity had to be confirmed, and exclusions checked, before activation and any bet (Portaria SPA/MF nº 722/2024, Annex I, item 10; Portaria 1.231/2024, art. 31, §6). Barred players included recipients of Bolsa Família and some other benefit or debt-relief schemes (art. 8) and self-excluded players, including through a central SPA platform added in November 2025 (art. 2, XXII and XXIII).
• Re-verification: facial recognition again for data changes, withdrawals, periodic confirmation and account closure; annual data update, with the account suspended until done (Portaria 1.231/2024, arts. 34 and 36).
• One player, one account: one account per brand, and the CPF could never be changed or transferred (arts. 31, §7 and 33).

5. Digital channels: what's different

Bottom line: the ban itself is channel-neutral, covering physical and virtual betting alike, but its enforcement tools are almost all aimed at the online channel: site blocking, app-store removal, platform liability and payment refusal.

Site blocking and app stores

The Ministries of Finance and Justice may request blocking of betting sites; ANATEL passes orders to internet providers and CGI.br handles ".br" domains (MP 1.394/2026, art. 23). App stores and operating systems must keep betting apps off and remove them on notice (art. 21).

Platform duty of care

All betting advertising and sponsorship aimed at the Brazilian public is banned in any medium and treated as abusive advertising under the Consumer Defence Code (arts. 16 and 18). Internet application providers must also prevent its circulation, including third-party content, and take it down on notice (arts. 19 and 20). Sanctions run from a warning to a fine of up to 10% of the group's Brazilian turnover or, without turnover, R$ 10 to R$ 1,000 per registered user capped at R$ 50 million per infringement, then suspension or prohibition for repeat breaches (art. 22).

Location controls under the former regime

Remote systems had to check location before the first bet on each device and every 30 minutes, detect remote-desktop and virtualisation tools, and log IP addresses to catch VPN or proxy use (Portaria SPA/MF 722/2024, Annex I, items 27, 28, 32 and 33). In-person betting was limited to sports bets on terminals linked to the player's registered account; online games could be offered only online (Portaria 722/2024, art. 12; Portaria 1.231/2024, art. 28, V).

6. Data protection and biometrics

The Brazilian Data Protection Law (Lei nº 13.709/2018, LGPD) treats biometric data as sensitive (art. 5, II). Without consent, sensitive data may be processed to prevent fraud and protect the data subject in identification and authentication processes in electronic systems (art. 11, II, g), the basis most relevant to facial recognition. The ANPD may fine up to 2% of Brazilian turnover, capped at R$ 50 million per infringement (art. 52, II).

Biometric check results that support AML or audit duties fall within former operators' five-year record duty (MP 1.394/2026, art. 10, IV).

7. Sector-specific obligations

Payment blocking: the core control now

Financial and payment institutions and payment scheme participants may not process, settle or facilitate fixed-odds betting transactions, except for wind-down and refunds (MP 1.394/2026, art. 14). Resolução BCB nº 590/2026 applies this from 25 September 2026 and lets scheme owners change their rules without prior BCB approval; Resolução BCB nº 597/2026 wrote the duty into the Pix Regulation.

Under Decreto nº 13.033/2026, the SPA records each illegal operator in a finding of irregularity and sends blocking notices through a secure electronic system (arts. 4 and 5). Institutions then have 24 hours to block every account of the named operator and to reject payments to it and new transactions that facilitate it, and 48 hours to tell the SPA what they did (Resolução CMN nº 5.320/2026, arts. 2 to 4). Blocked balances can be forfeited to the federal government administratively, without a prior court ruling (Law 14.790/2023, art. 21-A, §2-A).

Detecting illegal operators and intermediaries

Portaria SPA/MF nº 2.750/2026 requires institutions to monitor for transactions with illegal operators or "intermediary persons" whose accounts collect bettors' money, and to notify the SPA by the next business day after concluding the analysis. In card schemes the duty falls on the acquirers and sub-acquirers that contract with the merchant (arts. 4, 5, 7 and 8). The SPA notice is separate from AML reporting to COAF. Institutions that keep processing such payments after a formal SPA notice are jointly liable for the operator's taxes (Lei Complementar nº 224/2025, art. 6, I).

8. Risk indicators and red flags

Illegal betting payment typologies (SPA Portaria 2.750/2026) and player-level indicators (SPA Portaria 1.143/2024)

• Fan-in to one account: many small or medium transfers from unrelated people, in short intervals, concentrated on one recipient.
• Betting words in payment fields: descriptions mentioning bets, deposits, bonuses, top-ups, prizes or betting brands.
• Rotating Pix keys: successive changes of Pix keys, QR codes or payment links after a block or rejection.
• Deposit and withdraw without play: funds withdrawn soon after deposit with no bet placed.
• Bet intermediaries: one account placing bets for others, or deposit volumes that suggest it.

9. Enforcement and penalties

Former licensees that miss wind-down obligations face the sanctions in Law 14.790/2023, art. 41, applied by the Ministry of Finance (MP 1.394/2026, art. 12; Portaria SPA/MF 3.005/2026, art. 6): for companies, fines of 0.1% to 20% of the previous year's gross gaming revenue, at least the gain obtained and up to R$ 2 billion per infringement, plus suspension, bans of up to ten years and disqualification of managers for up to 20 years. Fines double for repeat offences within three years (art. 42).

Sanction proceedings open on 25 September 2026 were suspended and will be closed for operators that complete every transition obligation on time and receive the SPA's regulatory compliance statement; otherwise the suspension is lifted after 15 December 2026 (MP 1.394/2026, art. 13; Portaria 3.005/2026, art. 7). AML failures remain punishable under the AML Law: fines of up to twice the transaction value, twice the profit obtained, or R$ 20 million, plus disqualification of managers for up to ten years (art. 12).

By 9 October 2026 the Ministry of Justice and the SPA had referred more than 20,000 illegal betting and advertising sites for blocking. In the first week, 186 apps on the Apple and Google stores were notified for removal and eight large platforms were told to remove betting adverts (Ministry of Justice, 2 and 9 October 2026).

10. Recent changes and what to watch

• 23 November 2026[In force, conversion vote pending]: end of Congress's deliberation period for MP 1.394/2026, extended once by 60 days if the vote is not finished. As of 11 November the joint committee had not been set up; urgency rules apply from 9 November.
• 15 December 2026[In force]: final deadline for former licensees' reporting and levy obligations under Portaria SPA/MF 3.005/2026.
• 9 November 2026[STF interim order]: Justice Luiz Fux suspended, nationwide, all lower-court cases on the constitutionality of the measure until the Federal Supreme Court (STF) rules, in ADI 8027, after a public hearing on 3 November; the order awaits confirmation by the full court. ADIs 8024, 8027, 8028 and 8035 challenge the measure.
• 25 September 2026[In force, not yet converted]: nationwide ban on fixed-odds betting and extinction of all licences (MP 1.394/2026).
• 10 September 2026[In force]: SPA rules on detecting and reporting payments to illegal operators (Portaria SPA/MF 2.750/2026).
• 25 June 2026[In force]: 24-hour account blocking on SPA notice (Res. CMN 5.320/2026).

Congress may convert the measure with amendments (99 were tabled). Under art. 62 of the Constitution, an unconverted measure loses effect from its date of issue after 60 days, extended once by 60, with the count paused during congressional recess (§§3, 4 and 7); relationships formed under it stay governed by it unless Congress issues a legislative decree (§11). Whether extinguished licences could revive after a lapse is not settled.

11. What this means for identity verification

• No player onboarding: while the ban stands, onboarding players in Brazil for sports betting or online casino games is unlawful, including from abroad.
• Keep the evidence: former operators should keep onboarding records (ID images, facial recognition and liveness results, CPF checks, IP logs) for at least five years.
• Payment providers carry the identity burden: merchant onboarding (KYB) must screen out betting operators, intermediaries and front companies.
• Plan for two outcomes: if the market reopens under the earlier SPA model, expect mandatory facial recognition with liveness at registration and before withdrawals, CPF validation, accounts only in the player's name and geolocation every 30 minutes.